main.zeek

Base Modbus analysis script.

Summary

Well-known ports for Modbus.

`Log::ID`: `enum`	`Modbus::LOG`
`connection`: `record`	New Fields: `connection` modbus: `Modbus::Info` `&optional`

Event that can be handled to access the Modbus record as it is sent on to the logging framework.

Type:

set [port]

Attributes:

&redef

Default:

{
   502/tcp
}

Well-known ports for Modbus.

Type:

record

Fields:

unit: count &log &optional: The terminal unit identifier for the message

func: string &log &optional: The name of the function message that was sent.

pdu_type: string &log &optional: Whether this PDU was a response (“RESP”) or request (“REQ”)

exception: string &log &optional: The exception if the response was a failure.

track_address: count &default = 0 &optional: (present if policy/protocols/modbus/track-memmap.zeek is loaded)

Event that can be handled to access the Modbus record as it is sent on to the logging framework.